The BROWSER Act

Submitted on June 9, 2017

You’re reading the Benton Foundation’s Weekly Round-up, a recap of the biggest (or most overlooked) telecommunications stories of the week. The round-up is delivered via e-mail each Friday; to get your own copy, subscribe at www.benton.org/user/register

Robbie's Round-Up for the Week of June 5-9, 2017

On May 18, House Communications Subcommittee Chairman Marsha Blackburn (R-TN) introduced the BROWSER Act (H.R. 2520), legislation that would apply privacy regulations to both Internet service providers (ISPs) and edge providers (e.g., Netflix and Facebook). Most notably, the bill would require companies to obtain users' permission before sharing their sensitive information, including web-browsing history, with advertisers. The legislation is surprising, as it comes just weeks after Blackburn led the vote to repeal the Federal Communications Commission’s privacy protections for broadband subscribers. Below we unpack the BROWSER Act and take a look at what to expect in the weeks ahead.

Internet Privacy Rules

In 2015, when the FCC reclassified broadband Internet access service under Title II of the Communications Act in the effort to ensure net neutrality, the agency assumed jurisdiction over broadband providers on issues like protecting consumer privacy. The Federal Trade Commission is normally the federal agency that takes enforcement action against “unfair or deceptive acts or practices”, including privacy violations. However, the FTC is bound by the “common carrier exemption” which gives the FCC jurisdiction over telecommunications companies.

In October 2016, the FCC voted to adopt strong privacy rules aimed at giving consumers greater control over their ISPs’ use and sharing of their personal information. [I wrote about the decision and the specifics of the rules in the article FCC Acts to Increase Consumer Privacy Choice]. At the time of the decision, many industry leaders opposed the rules, arguing that privacy regulation should apply equally to ISPs and edge providers. “Fully harmonizing privacy rules around the tested and successful FTC approach would best serve the future of an internet responsive to consumer expectations,” USTelecom President Walter McCormick said.

A lot has happened since October of 2016 (to say the least). With the election of President Donald Trump, the appointment of FCC Chairman Ajit Pai, and a GOP-controlled House and Senate, large shifts in privacy policy have come quickly.

Just two months ago, in a very narrow, largely party-line vote (215-205), the U.S. House of Representatives followed the Senate in voting to revoke the privacy rules created by the FCC in October. At the time, I wrote in Your Privacy is a Partisan Issue that, “The vote to repeal the FCC privacy rules means broadband providers now are players in the $83 billion market for online advertising. Your broadband provider now can collect, store, share, and sell your online behavioral information for profit without seeking your explicit consent.” After the vote, Chairman Blackburn said, “I think that people should realize that the FTC is the primary regulator of privacy, not the FCC. They have the history and the expertise to regulate consumer privacy, and having more than one agency regulate the same [issue] creates abuse and government overreach. Businesses need regulatory clarity in order to properly operate.” It looks like Blackburn got to work on that.

Enter the BROWSER Act

In introducing the Balancing the Rights of Web Surfers Equally and Responsibly (BROWSER) Act, Chairman Blackburn says she aims to:

Create a level playing field. The legislation applies privacy rules equally to ISPs and edge providers. “The government should not pick winners and losers when it comes to the privacy of Americans,” Blackburn said in announcing the bill. “This bill creates a level and fair privacy playing field by bringing all entities that collect and sell the personal data of individuals under the same rules.”
Create an Opt-In Worldview. Blackburn's bill would require companies to provide opt-in for use of sensitive information and opt-outs for use of non-sensitive data. Companies could not refuse service if you opt-out, either. Sensitive user information, according to the bill, would not only include financial and health data, but web browsing and app usage history. Many have noted that such data is the lifeblood of digital ad audience targeting, and has historically been treated as non-sensitive data by the digital media and advertising industries. The bill also defines "precise geo-location data" as sensitive, potentially hampering new efforts by tech companies to track online and offline physical purchasing data such as the one Google announced in May.
Put the FTC in Charge of Privacy Enforcement. Many GOP lawmakers have been calling for the FTC to be the sole privacy cop for both ISPs and edge providers.
Preempt State Privacy Laws. The bill would prevent both the FCC and states from pursuing similar online privacy regulations. After the recent vote to repeal the FCC’s privacy rules, numerous states started the process of crafting legislation to protect consumers’ personal information.

Reactions (Or Lack Thereof)

The reactions to the BROWSER Act have been few are and far between. The Internet Association -- which represents large edge providers like Amazon, Facebook, and Google -- is concerned the bill would "upend the consumer experience online and stifle innovation." Bob Quinn, AT&T's top lobbyist, called the legislation "the first draft of the bill." He added, "We'll see where it all goes."

Some have noted that the BROWSER Act may result in loss revenue to the online advertising industry, resulting in a more expensive online experience, particularly for low-income households that cannot afford to pay for many online services. Many edge providers make billions of dollars by selling relevant advertisements to consumers based on data the companies have collected. A regulatory disruption to this model is sure to create ripple effects across the digital economy.

Reaction to the bill has been generally quiet among privacy advocacy groups. Public Knowledge’s Chris Lewis said, “We are pleased to see several Members of Congress take steps to respond to the concerns consumers expressed after Congress repealed the FCC's broadband privacy rules. However, we are still evaluating this bill and others addressing consumer privacy concerns and have yet to take a position.”

Concerns About FTC as Sole Enforcer
When the FCC’s rules were repealed, many consumer advocates claimed that the FTC is an inadequate authority for enforcing privacy, due to the lack of telecommunications expertise and differences in enforcement capabilities between the two agencies. Benton Senior Counselor at the Public Interest Communications Law Project at Georgetown University Law Center's Institute for Public Representation Andrew Schwartzman, wrote, “For the most part, the FTC does not have the power to adopt forward-looking rules. Instead, it generally brings enforcement proceedings on a case-by-case basis after it has determined that a company under its jurisdiction has violated Section 5.” Indeed, as former counselor to the FCC Chairman Gigi Sohn put it, “There’s a very important difference between the FTC’s enforcement powers and preventative FCC rules: the FCC’s rules have the power to protect consumers before they are harmed, while the FTC’s rules moderate industry behavior and give consumers the ability to enforce their rights after harm occurs.”

Net Neutrality Connection
The BROWSER Act may ultimately be deemed unnecessary if the FCC again reclassifies broadband Internet access service under Title I of the Communications Act (undoing the pivotal 2015 Title II decision). If the FCC follows through on this current proposal, then privacy jurisdiction over ISPs would go back to the FTC.

Comcast Senior Executive Vice President David Cohen said, “I think the fervor for privacy legislation may disappear if the FCC does proceed in four or five months and reclassifies broadband under Title I because then the FTC will again have jurisdiction to enforce privacy against ISPs as well as the internet ecosystem, so then there may be a question of whether any congressional legislation is necessary at that time,” Cohen said.

Future of the BROWSER Act

According to Axios, it is not clear that the BROWSER Act has the support it would need to move through Congress, and it currently lacks a corresponding version in the Senate. Earlier this month, Chairman Blackburn sent out an email to all Democratic Representatives asking them to cosponsor her bill. “Rep. Blackburn is a former co-chair of the bi-partisan Congressional Privacy Working group,” her e-mail to Democrats read. “Moreover, she has not been accepting additional Republican co-sponsors while in the midst of taking stakeholder meetings and beginning outreach to Democrats.” Additionally, Blackburn spoke on C-SPAN’s “The Communicators” saying she intends to broach the topic with the Administration as it continues to craft an infrastructure package. “As we move forward with broadband expansion and the infrastructure bill, it will give me the opportunity to talk with [the White House] and seek support for what we’re doing with privacy,” she said.

You can follow the BROWSER Act and all Internet privacy news each day in Headlines.

Quick Bits